Security teams are still leaning on training to fight phishing, but the latest survey data suggest that approach has limits. Among 1,890 technology and security professionals surveyed by Talker Research for Yubico and Okta, 82% said they had received employer security training. Yet 23% said their organizations did not require multifactor authentication, or MFA, across all applications and services.
That gap matters because phishing is no longer just a clumsy email full of typos. Lorrie Faith Cranor, director of Carnegie Mellon University’s CyLab and a co-founder of Wombat Security Technologies, said scams can succeed because they tap into real needs, such as finding a job, resolving an immigration concern, or pleasing the boss. She added that even people with good habits can lower their guard when they are busy or distracted.
The survey also found that 55% of respondents had been directly targeted by personalized phishing attacks, and 44% said their organization had experienced at least one successful AI-driven phishing attack in the previous year. Cranor said many phishing messages are now written by AI agents with perfect grammar and spelling that mimic corporate style and branding.
The test results were not encouraging. Respondents were shown two versions of an HR email asking staff to sign off on an updated handbook, one written by a person and one by AI. Only 36% correctly identified the human-written message, while 54% thought AI wrote it.
Yubico’s chief market and growth officer, Poupak Modirassari Enbom, put the problem plainly: 'The gap was not the awareness; it was the adoption.'
The survey, released Oct. 7, covered professionals in technology and security roles at companies with at least 500 employees across nine countries. Yubico sells hardware security keys, and Okta provides identity management services. The two companies announced a partnership alongside the survey.
The report recommends stronger authentication at onboarding. Some 52% of respondents said they received username-and-password credentials when starting their roles. Passkeys, which use cryptographic credentials tied to a legitimate site, would block a login attempt on an imitation website. But even that does not stop a worker from being tricked into handing over gift cards or other value at a scammer’s request.
Cranor said MFA still provides substantial protection, but its forms vary. Text-message codes can be vulnerable if an attacker persuades a mobile carrier to transfer a victim’s number. Even an authenticator app can be undermined by deception if a scammer poses as a help-desk employee and tricks someone into reading out a code.
For employers, the economics are obvious. Training has value, but it is not a substitute for hard controls that protect accounts when human judgment fails. Capital rewards clear rules, not wishful thinking. If a company treats MFA as optional, it is leaving the taxpayer of corporate balance sheets exposed to a risk that modern phishing is designed to exploit.
